Detecting sources of computer viruses in networks | Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems (original) (raw)

Authors Info & Claims

Published: 14 June 2010 Publication History

Abstract

We provide a systematic study of the problem of finding the source of a computer virus in a network. We model virus spreading in a network with a variant of the popular SIR model and then construct an estimator for the virus source. This estimator is based upon a novel combinatorial quantity which we term rumor centrality. We establish that this is an ML estimator for a class of graphs. We find the following surprising threshold phenomenon: on trees which grow faster than a line, the estimator always has non-trivial detection probability, whereas on trees that grow like a line, the detection probability will go to 0 as the network grows. Simulations performed on synthetic networks such as the popular small-world and scale-free networks, and on real networks such as an internet AS network and the U.S. electric power grid network, show that the estimator either finds the source exactly or within a few hops in different network topologies. We compare rumor centrality to another common network centrality notion known as distance centrality. We prove that on trees, the rumor center and distance center are equivalent, but on general networks, they may differ. Indeed, simulations show that rumor centrality outperforms distance centrality in finding virus sources in networks which are not tree-like.

References

[1]

The CAIDA AS relationships dataset. http://www.caida.org/data/active/as--relationships, August 30th, 2009.

[2]

N. T. J. Bailey. The Mathematical Theory of Infectious Diseases and its Applications. Griffin, London, 1975.

[3]

A. Barabasi and R. Albert. Emergence of scaling in random networks. Science, 286:509--512, 1999.

[4]

P. Bonacich. Power and centrality: A family of measures. American Journal of Sociology 92:1170{1182, 1987.

[5]

L. C. Freeman. A set of measure of centrality based on betweenness. Sociometry, 40:35--41, 1977.

[6]

A. Ganesh, L. Massoulie, and D. Towsley. The effect network topology on the spread of epidemics. Proc 24th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM 2:1455--1466, 2005.

[7]

C. Moore and M. E. J. Newman. Epidemics and percolation in in small-world networks. Phys. Rev. E, 61:5678--5682, 2000.

[8]

M. E. J. Newman. The spread of epidemic disease on networks. Phys. Rev. E, 66:016128, 2002.

[9]

H. Okamura, K. Tateishi, and T. Doshi. Statistical inference of computer virus propagation using non-homogeneous poisson processes. Proc. 18th IEEE International Symposium on Software Reliability, 5:149--158, 2007.

[10]

R. Pastor-Satorras and A. Vespignani. Epidemic spreading in scale-free networks. Phys. Rev. Lett., 6:3200--3203, 2001.

[11]

G. Sabidussi. The centrality index of a graph. Psychometrika, 31:581--603, 1966.

[12]

G. Streftaris and G. J. Gibson. Statistical inference for stochastic epidemic models. Proc. 17th international Workshop on Statistical Modeling, pages 609--616, 2002.

[13]

D. J. Watts and S. Strogatz. Collective dynamics of `small--world' networks. Nature, 393:440--442, 1998.

Information & Contributors

Information

Published In

cover image ACM Conferences

SIGMETRICS '10: Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems

June 2010

398 pages

Copyright © 2010 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 June 2010

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. epidemics
  2. estimation

Qualifiers

Conference

Acceptance Rates

Overall Acceptance Rate 459 of 2,691 submissions, 17%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

Reflects downloads up to 31 Dec 2024

Other Metrics

Citations

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Sign in

Full Access

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Affiliations

Devavrat Shah

Massachusetts Institute of Technology, Cambridge, MA, USA

Tauhid Zaman

Massachusetts Institute of Technology, Cambridge, MA, USA